ChatGPT becomes the first AI chatbot designated under the DSA

The European Commission has classified ChatGPT as a search engine. Monday’s designation brings the chatbot under the Digital Services Act as a Very Large Online Search Engine, alongside Reddit and Roblox, which have been designated as Very Large Online Platforms.

ChatGPT is the first AI chatbot to be designated under the regime. The Commission announced the decision after signalling in July that it intended to act as soon as August.

The designation itself follows a fairly simple calculation. Services with more than 45 million monthly users in the EU fall under the DSA’s threshold, and ChatGPT reported 159 million monthly active users across the six months to March 2026.

Reddit and Roblox also cleared the threshold, although by a smaller margin. Reddit reported 57.2 million monthly users, while Roblox had roughly 48 million, putting both above the limit but well below ChatGPT’s reported reach.

The more unusual part is the decision to treat ChatGPT as a search engine. A chatbot that responds to questions in prose is now being regulated in the same category as services that organise and direct users to information on the web.

The distinction matters because the DSA imposes different requirements depending on what kind of service is being designated.

For ChatGPT, that means the Commission is applying search-related obligations to a system that does not simply retrieve and rank web pages, but generates answers.

That raises questions about how those answers are produced, what risks they create, and how those risks can be assessed.

The designation itself does not introduce a new set of rules. Instead, it brings the three companies into a compliance regime that requires annual systemic risk assessments covering areas including illegal content, the protection of minors, physical and mental wellbeing, fundamental rights, electoral processes and public security.

The companies will also have to submit to independent audits and provide access to data for regulators and vetted researchers.

Data access has been one of the more contentious parts of the DSA for large online platforms, particularly when researchers seek information that companies consider commercially sensitive.

“These new designations mean that ChatGPT, Reddit and Roblox will now be held to a higher standard of scrutiny and accountability,” said Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, security and democracy.

The companies have four months to comply, putting the deadline at the end of November. The DSA allows the Commission to impose fines of up to 6% of a company’s global annual turnover for serious violations.

For Roblox, the requirements around minors are particularly significant. Much of the platform’s audience is made up of children and teenagers, so the company will now have to formally assess and mitigate risks to their safety and wellbeing, with those measures subject to independent auditing.

OpenAI faces a different problem. Its assessment will have to address systemic risks around electoral processes and public security, among other areas.

For a general-purpose AI system used for everything from everyday questions to political information, that means translating broad concerns about how AI can influence people at scale into risks that can actually be identified, measured, and audited.

Reddit’s designation raises another set of questions. It is the smallest of the three services by user numbers, but it hosts a huge amount of public discussion and has become an increasingly valuable source of data for AI companies.

Reddit has spent the past two years turning access to that content into a licensing business, making the platform’s relationship with AI developers an increasingly important part of its commercial model.

The designations also have a specific legal anchor. They apply to named entities rather than simply to the consumer-facing brands: OpenAI Ireland Limited, Reddit Netherlands B.V. and Roblox Corporation are listed in the Commission’s register, with national regulators in Ireland and the Netherlands sharing enforcement responsibilities with the Commission.

The decision comes as European technology enforcement is becoming more active across several fronts.

Poland has asked the Commission to fine Meta €250 million over scam advertising, while the Commission is separately preparing measures that would require Google to open Android to rival AI assistants under the Digital Markets Act.

Neither OpenAI, Reddit nor Roblox has publicly challenged the designations. They can appeal the decisions, although doing so would put the companies in the unusual position of disputing a classification based largely on user numbers they have themselves reported.

The broader significance is that the DSA is now being applied well beyond the social networks and content platforms it was originally associated with.

In a single announcement, the Commission has brought a chatbot, an online forum and a platform heavily used by children under the same high-level regulatory framework, even though the services create very different kinds of risks.

The practical test will come in November, when the first risk assessments are due. For OpenAI in particular, the interesting question will be whether a framework designed around traditional online platforms can meaningfully account for a system that generates information rather than simply hosting or distributing it.